bitly/oauth2_proxyArchived
Oauth2 Proxy
oauth2_proxy 是一个 OAuth2 反向代理和身份验证网关，通过要求用户通过外部身份提供商进行身份验证来保护上游服务。它充当缺乏内置用户身份验证的后端应用程序的安全登录层。
该项目通过基于电子邮件域、组织成员资格或批准的用户列表限制进入，提供集中式访问控制。它通过颁发者 URL 和客户端密钥与身份提供商集成，并支持 htpasswd 文件等其他身份验证方法。
该网关通过自定义 HTTP 标头或基本身份验证将经过身份验证的用户详细信息和访问令牌传递给后端服务，从而管理安全身份转发。它包括会话 Cookie 管理、SSL 连接终止以及使用正则表达式豁免特定请求路径进行身份验证的功能。通过 HMAC 请求签名验证代理请求的来源，提供了额外的安全性。
流量和系统可观测性通过传入请求日志记录和详细的代理请求元数据得到支持。该系统还允许通过 HTML 模板自定义身份验证页面，并支持从文件自动重新加载配置。
Features
- Authenticated Web Service Proxies - Acts as an authenticated proxy that validates users before forwarding requests to internal web services.
- HTTP Reverse Proxies - Acts as an HTTP reverse proxy that intercepts incoming requests to validate credentials before forwarding traffic to upstream services.
- Organization-Based Access Management - Blocks authentication for users who are not verified members of a specified organization or team.
- Authenticated Request Proxies - Forwards authenticated requests to backend services while injecting the user's identity and access tokens into HTTP headers.
- Traffic Proxying - Forwards authenticated requests to multiple backend servers or serves local static files.
- Access Control Centralization - Provides a centralized point for managing access to a suite of tools based on email, organization, or user lists.
- Email Domain Restrictions - Restricts access to the protected upstream services based on specific email domains or a predefined list of approved addresses.
- Authentication Gateways - Provides a security layer that enforces access policies and integrates with external identity providers to protect services.
- User Identity Forwardings - Passes authenticated username and group details to backend servers using custom HTTP headers or Basic Auth.
- Identity Provider Integrations - Connects internal applications to external identity services like Google or GitHub to manage user access.
- Identity Providers - Integrates with external identity providers to delegate user authentication and session management via OAuth2 and OIDC.
- OAuth2 Implementations - Implements the standard OAuth2 authorization code grant flow to delegate user authentication to external identity providers.
- Reverse Proxies - Implements a reverse proxy that requires authentication through OAuth2 identity providers before granting access to upstream services.
- Cookie-Based Session Management - Tracks authenticated user states using encrypted session cookies to maintain identity without repeated provider redirects.
- Traffic Protection - Protects private web applications by requiring a valid authenticated session before forwarding traffic to the upstream server.
- Identity Header Injections - Injects authenticated user metadata and access tokens into request headers for consumption by protected backend applications.
- Membership Verifications - Restricts access to services based on a user's membership in specific Google Groups validated via a service account.
- Authentication Bypass Rules - Allows specific endpoints to be exempted from authentication requirements using regular expression path matching.
- SSL Termination Proxies - Handles encrypted traffic termination using certificates and keys to offload SSL/TLS overhead from backend services.
- Authentication Exemptions - Allows specific request paths to be exempted from authentication checks using regular expression matching.
- Htpasswd Authentications - Validates user credentials against hashed passwords stored in htpasswd files for local user authentication.
- Cryptographic Request Signers - Implements cryptographic signing of outgoing HTTP requests to verify the authenticity of the proxied traffic.
- Request Signing - Adds cryptographic HMAC signatures to headers to verify the origin and authenticity of proxied requests.
